7 ms·

Why I still have an old-school cert on my HTTPS site

16 points by picture 4y ago

ggm 4y ago
It has an infrastructure cost. Either it's donated or it's cost is recovered. The shifty part is not being very up front about this although I suspect bits of this are tech "do I look like I read the manual" things. I use letsencrypt. It's less shifty than normal CA to me.
winrid 4y ago
So you auto renew every 90 days. Is that really a problem vs doing it every year or so with a paid cert? What am I missing?
- epse 4y ago
  If you're talking about the "saner" service OP talks about at the end, I read that as 90 days and then you have to start paying
  - winrid 4y ago
    LetsEncrypt with auto renewals via certbot is free unless there's some misunderstanding here.
    - fargle 4y ago
      I missed this too, took three readings to de-conflate that Rachel's talking about some other unnamed scummy service, for the bulk of the writeup not certbot/LE.
      - winrid 4y ago
        Ah okay. I suppose you have more patience than me. :)
t00 4y ago
Automation is king with Let's Encrypt. I just add a daily cron job to run certbot renew and don't worry about the rest.
xmodem 4y ago
I hadn't realised the certbot implementation was quite that bonkers. A while ago I spent far too long trying to get certbot+nginx working sensibly in docker, before giving up and using caddy instead, which embeds an ACME implementation into the HTTP server. I can't speak to the quality of it though.
isotopp 4y ago
Rachel's Site shows an Apache 2.4 banner. Apache has a little known module as part of the build, at least in Ubuntu: mod_md. Use this, it is trivial to set up, and completely automated the Let's Encrypt workflow and renewal, no external stuff necessary. It is as simple as adding a few lines to the global config, remove almost all SSL config and restarting the server (twice).
- yjftsjthsd-h 4y ago
  Yes, but the author doesn't seem to care about how easy it is to use existing software; all the criticisms here seem to be attacking the underlying protocol and nitpicking implementation details. I'm sure if she looked at mod_md she'd download the source code and find a bunch of (in her view, at least) problems.
DanAtC 4y ago
certbot also now insists on using snapd, even on Debian. There's still certbot packages in the distros' repos, but who knows how long they'll continue to work.
ranting-moth 4y ago
That rant sounds like me some years and years ago. I don't mind if the protocol if FUBAR. It works for me and it works for an awful lot of people. And it encrypts the web. Before that, it was manually re-creating a cert, faffing with chains (converting formats and dealing with bad documentation) and update the production servers manually. It was a royal PITFA. Don't forget to set a calendar reminder for the next year's renewal.
- agjmills 4y ago
  Or better, an alert to check the cert is still valid
  - yebyen 4y ago
    You don't want an alert to check the cert is still valid, that's how you get outages. It's an alert to check cert has at least 2 weeks or more life left in it! (So it either fires ideally before you leave for that long vacation, or so that you can still take care of it when you get back.)
    - agjmills 4y ago
      But also check it’s still valid, because revocations
      - GauntletWizard 4y ago
        This is all built in very nicely to https://github.com/prometheus/blackbox_exporter https://github.com/prometheus/blackbox_exporter - Though they could use a blazing red link to an example rules file.
- caiusdurling 4y ago
  There's also issuance via DNS which took most of the complexity out of it for me. (Especially as the first time I went to deploy LetsEncrypt I had something like four web servers behind a LoadBalancer without the LB terminating TLS.) I think the tooling has improved somewhat since too, although I didn't look too closely.
1vuio0pswjnm7 4y ago
Perhaps the process for obtaining a free 90-day LE certificate will be automated in TLS proxies so it is executed automatically every 90 days. Maybe the Kool-Aid eventually wears off and the reality sets in. No one likes "certificates as a business" except those who profit from it.
sourcecodeplz 4y ago
I sometimes use an older phone to browse the web. I've noticed that LE sites just don't load. It just says "can't establish a secure connection". Larger sites don't have this problem.
- sgt 4y ago
  I'm not sure about the exact year, but I doubt LE will work for devices before 2018. I think they changed their root cert at some point relatively recent. Edit - I stand corrected. Likely I've been confused by a few devices and Linux distros I had that simply broke on that day. Also, I remember having to manually fix a few Ubuntu servers that day when this happened. Anyone else had that experience around Oct 2021?
  - JonathonW 4y ago
    The big transition happened in October 2021-- that's when Let's Encrypt's root stopped being cross-signed by IdenTrust (allowing older devices that had the IdenTrust root but not the ISRG/Let's Encrypt root to still validate Let's Encrypt certs): https://letsencrypt.org/docs/certificate-compatibility/ https://letsencrypt.org/docs/certificate-compatibility/
    - sgt 4y ago
      I corrected my message - but I am still pretty sure that some of our Ubuntu servers broke that day, despite having been updated. Unfortunately I can't remember the details. Good to know that this didn't affect most phones etc.
  - chedabob 4y ago
    https://letsencrypt.org/docs/certificate-compatibility/ https://letsencrypt.org/docs/certificate-compatibility/ Support goes back pretty far.
    - sourcecodeplz 4y ago
      Not far enough it seems, the link you posted has the same problem. Edit: this particular device is iPhone 4
MarkusWandel 4y ago
Old school? Old school was when you could put up a harmless, noncommercial, mostly static HTML web site and run it over plain http without being considered some info security risk outlier. I have one of these web sites. After some coaching from a modern web literate colleague, it now autopromotes to https using a LE certificate. It works. Or does it? Half my relatives who access a (private and password protected) photo server promptly reported losing access. This is the still using 32-bit Chrome on Windows XP, save a password in a browser once and then never think about it again, kind of crowd.
- sourcecodeplz 4y ago
  True dat, way to many devs nowadays don't really test things properly. Accessibility is something I've always taken a liken to, sometimes maybe obsessively. But them again I interacted and went to workshops with people from places around the world that don't have high speed internet still nor the latest devices. Look at gov.uk ... That site is an accessibility masterpiece.
deleted 4y ago
[deleted]
EMIRELADERO 4y ago
So, the post's title says they won't use LE, but the actual post's content has nothing negative to say about it and instead bashes some other free SSL cert service? Why not use LE instead then?
- nulbyte 4y ago
  I am equally perplexed. > This is about me finding a supposed alternative and going through the same process of due diligence to understand just what I'd be getting into. I don't think the author has a good understanding of Let's Encrypt. Whatever service the author found claiming to be better seems to be lying, based on the author's experience. For the benefit of the unfamiliar who stumble upon this, getting a Let's Encrypt certificate is a fairly painful process, unless you make it painful. Many hosting providers have the process built into their offering. For those self-hosting, the certbot client is very easy to use, after setting up your site and domain, which you would need to do regardless of what service you use to obtain a certificate. It only gets complicated if you have a complicated set-up, such as a non-public site or are perhaps using some specialized web services software, in which case I would assume you are sufficiently technically inclined to overcome the obstacles you yourself built. In any case, I find free and automated is preferable to expensive and manual.
  - justin_oaks 4y ago
    When I first got started with LetsEncrypt, I wanted to do the whole thing manually so I could understand it better. This was probably 4 years ago. I expected a web form to fill out (e.g. what domain to do you want, paste your CSR here, etc.), but such a thing didn't exist. The LetsEncrypt site didn't have much useful in the way of instructions except to say "Use Certbot". So I set up certbot, ran it in manual mode, and got my certificate. Cool. The only problem was that there was a little too much magic. What is this "account" that I'm using to renew my certificate if I never made an account (i.e. username password). What happens if I accidentally delete all the files certbot created for me? And a bunch of other questions. The documentation I found didn't give a whole lot of straightforward answers. Instead I pieced together information from blogs and forum posts. I'm hoping the documentation situation has changed, but I can understand how someone can be confused about LetsEncrypt. Many people are happy to use something without any concerns about how it works. Others want to understand and when they find that they can't, they get frustrated.
9dev 4y ago
She really complains how ACME is bad because a client implementation has code written in lines sometimes exceeding 200 characters..? How about we stop trying to micromanage essential services on our servers, and just get on with literally anything else that brings actual value? Let’s encrypt works, it works without attention, it’s free, and ubiquitous.
- joe-collins 4y ago
  Whatever technical merit the rest of the rant may have had, screaming that long lines killed puppies certainly burned a lot of provisional credibility.
- sourcecodeplz 4y ago
  It doesn't work for me, on one of my older phones.
  - xcjs 4y ago
    If so, that's by design in a way. That's an indicator that your root level certs are not being maintained or updated. That risk is worse than just a few certificate authorities not being recognized.
- sigmoid10 4y ago
  >Let’s encrypt works, it works without attention, it’s free, and ubiquitous. It's not so easy, since there is always a tradeoff with these things. The exact same argument could be applied to Java as a backend and many people happily do so... until it turns out that some lone guy in Switzerland, who has thanklessly maintained a highly popular logging library for the last 20 years, forgot to sanitise certain inputs. Aaaand now you have remote code execution on Apple's servers and just about every other Fortune 500 company. The world needs more people who scrutinise widely used security relevant software, not less.
- KMnO4 4y ago
  The inevitable folly of an engineer is succumbing to that nagging desire to tear down the existing solutions and build your own.
pwdisswordfish9 4y ago
Instead of whinging you could just write your own script, if for some reason you're not okay with running the same code as tons of other people?
metanonsense 4y ago
As someone who had to automate OpenSSL workflows often enough (fortunately, way in the past), the described automated signing workflow sounds much like an automated signing workflow. While I hope that the mentioned 200 character line width is being used more as a literary device (elevating snarkiness) than for an actual argument, I fear the latter. Having said that, don't all (public) SSL signing workflows use web technologies in some way? To me, using some web technologies (aka 'kool aid') specifically made for this purpose, such as jwk, feels better than having some intermediaries sending back and forth CSRs, keys, and whatsoever using home-made interfaces and data structures.
deathanatos 4y ago
… well, I kinda like ACME. It's one of the few actually RESTful protocols out there, so it is quite straight-forward to navigate. The media types are well specified compared to some HTTP APIs.¹ certbot (presuming that's the thing she's talking about the code quality of) can be a bit hard to interface with if you stray outside the default set of use cases, IMO. I don't know why it would be shelling out to openssl, though, when Python has cryptography, which is IMO one of the most pleasant libraries to work with if you need to build X.509 certs or CSRs etc. as it represents those things directly and plainly, and doesn't get in the way. … if the issuance limits on some random third party CA are a problem, … Let's Encrypt has generous limits. ¹my last experience was Github's API … which will happily have an attribute that's an enum, but not tell you what the variants are. Like … seriously? Azure's docs/data structs permit representing many illegal values easily, and don't document, e.g., when two things are mutually exclusive. The lack of REST in Azure's API means what could have easily been just a single attribute holding a URL gets broken out into 5 different attributes strewn across 3 different structs, a VM's initial image, I am looking at you.
trynewideas 4y ago
I would have loved to know more about the setup process and cost for the "old-school" cert. Looking at its metadata, it appears to be from Gandi,[1] which charges US$16/year for a single-address cert that works on standard hosting. (The "free" tier is if you buy Gandi web hosting, which starts at US$6.20/month.) 1: https://www.gandi.net/en-US/security?taxes=no https://www.gandi.net/en-US/security?taxes=no
indigodaddy 4y ago
Park that shit behind Caddy. Case closed.
fargle 4y ago
This was really difficult to parse, unusual for rachelbythebay. The article seems like it's ranting about Let's Encrypt (well it is a little). But a lot of the criticism seems wrong. Ah, the critical quote: > But what about now? This isn't about Let's Encrypt. This is about me > finding a supposed alternative and going through the same process of due > diligence to understand just what I'd be getting into. Somehow, a couple > of weeks ago, *I found this other site which claimed to be better than LE* It's ranting about some other scummy service that's never mentioned by name! It's kind of a scam with accounts and logins and a free tier that only lets you do 3 90 day certificates. Rachel likes the web API better. Well, yeah you still want to steer clear of that! (is it https://zerossl.com/pricing/ https://zerossl.com/pricing/ perhaps?) So then why not circle back to LE? The reason nobody seems to care about the ACME protocol is that it does get the job done. And if you don't like the "certbot" client, which can be kind-of a pain, there are like 50 other implementations. https://letsencrypt.org/docs/client-options/ https://letsencrypt.org/docs/client-options/ So you might not be able to do wildcard domains and the renewal period is a relatively short 90 days (both by design), but it's trouble free and actually free with no draconian limits. https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ Well, goodness please use whatever service you want. And if you dislike the code quality of LE enough to pay for a traditional certificate every 2 years, great. But it seems odd to be ranting about LE by name and then throwing a bunch of critiques about another different unnamed service in at the same time. If you gave up on LE in 2018, you might want to try again. It's honestly pretty decently simple to setup and feels pretty opinionated.
28304283409234 4y ago
> 270 days for one domain or 3 domains for 90 days, and then you're screwed. Isn't that great? Huh? I haven't looked at the fine print but I use quite a few more domains. Never ran into the rate limits.
- yjftsjthsd-h 4y ago
  With what provider? That part is talking about some unnamed alternative, not letsencrypt.
rubatuga 4y ago
Guessing she is talking about acme.sh, the 8000 line shell script. It has lines like: _dnsAltnames="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile" | grep "^ *DNS:.*" | tr -d ' \n')" But in its defense, acme.sh works on all major OS

16 points by picture 4y ago

ggm 4y ago

It has an infrastructure cost. Either it's donated or it's cost is recovered. The shifty part is not being very up front about this although I suspect bits of this are tech "do I look like I read the manual" things. I use letsencrypt. It's less shifty than normal CA to me.

winrid 4y ago

So you auto renew every 90 days. Is that really a problem vs doing it every year or so with a paid cert? What am I missing?

epse 4y ago
If you're talking about the "saner" service OP talks about at the end, I read that as 90 days and then you have to start paying
- winrid 4y ago
  LetsEncrypt with auto renewals via certbot is free unless there's some misunderstanding here.
  - fargle 4y ago
    I missed this too, took three readings to de-conflate that Rachel's talking about some other unnamed scummy service, for the bulk of the writeup not certbot/LE.
    - winrid 4y ago
      Ah okay. I suppose you have more patience than me. :)

t00 4y ago

Automation is king with Let's Encrypt. I just add a daily cron job to run certbot renew and don't worry about the rest.

xmodem 4y ago

I hadn't realised the certbot implementation was quite that bonkers. A while ago I spent far too long trying to get certbot+nginx working sensibly in docker, before giving up and using caddy instead, which embeds an ACME implementation into the HTTP server. I can't speak to the quality of it though.

isotopp 4y ago

Rachel's Site shows an Apache 2.4 banner. Apache has a little known module as part of the build, at least in Ubuntu: mod_md. Use this, it is trivial to set up, and completely automated the Let's Encrypt workflow and renewal, no external stuff necessary. It is as simple as adding a few lines to the global config, remove almost all SSL config and restarting the server (twice).

yjftsjthsd-h 4y ago
Yes, but the author doesn't seem to care about how easy it is to use existing software; all the criticisms here seem to be attacking the underlying protocol and nitpicking implementation details. I'm sure if she looked at mod_md she'd download the source code and find a bunch of (in her view, at least) problems.

DanAtC 4y ago

certbot also now insists on using snapd, even on Debian. There's still certbot packages in the distros' repos, but who knows how long they'll continue to work.

ranting-moth 4y ago

That rant sounds like me some years and years ago. I don't mind if the protocol if FUBAR. It works for me and it works for an awful lot of people. And it encrypts the web. Before that, it was manually re-creating a cert, faffing with chains (converting formats and dealing with bad documentation) and update the production servers manually. It was a royal PITFA. Don't forget to set a calendar reminder for the next year's renewal.

agjmills 4y ago
Or better, an alert to check the cert is still valid
- yebyen 4y ago
  You don't want an alert to check the cert is still valid, that's how you get outages. It's an alert to check cert has at least 2 weeks or more life left in it! (So it either fires ideally before you leave for that long vacation, or so that you can still take care of it when you get back.)
  - agjmills 4y ago
    But also check it’s still valid, because revocations
    - GauntletWizard 4y ago
      This is all built in very nicely to https://github.com/prometheus/blackbox_exporter https://github.com/prometheus/blackbox_exporter - Though they could use a blazing red link to an example rules file.
caiusdurling 4y ago
There's also issuance via DNS which took most of the complexity out of it for me. (Especially as the first time I went to deploy LetsEncrypt I had something like four web servers behind a LoadBalancer without the LB terminating TLS.) I think the tooling has improved somewhat since too, although I didn't look too closely.

1vuio0pswjnm7 4y ago

Perhaps the process for obtaining a free 90-day LE certificate will be automated in TLS proxies so it is executed automatically every 90 days. Maybe the Kool-Aid eventually wears off and the reality sets in. No one likes "certificates as a business" except those who profit from it.

sourcecodeplz 4y ago

I sometimes use an older phone to browse the web. I've noticed that LE sites just don't load. It just says "can't establish a secure connection". Larger sites don't have this problem.

sgt 4y ago
I'm not sure about the exact year, but I doubt LE will work for devices before 2018. I think they changed their root cert at some point relatively recent. Edit - I stand corrected. Likely I've been confused by a few devices and Linux distros I had that simply broke on that day. Also, I remember having to manually fix a few Ubuntu servers that day when this happened. Anyone else had that experience around Oct 2021?
- JonathonW 4y ago
  The big transition happened in October 2021-- that's when Let's Encrypt's root stopped being cross-signed by IdenTrust (allowing older devices that had the IdenTrust root but not the ISRG/Let's Encrypt root to still validate Let's Encrypt certs): https://letsencrypt.org/docs/certificate-compatibility/ https://letsencrypt.org/docs/certificate-compatibility/
  - sgt 4y ago
    I corrected my message - but I am still pretty sure that some of our Ubuntu servers broke that day, despite having been updated. Unfortunately I can't remember the details. Good to know that this didn't affect most phones etc.
- chedabob 4y ago
  https://letsencrypt.org/docs/certificate-compatibility/ https://letsencrypt.org/docs/certificate-compatibility/ Support goes back pretty far.
  - sourcecodeplz 4y ago
    Not far enough it seems, the link you posted has the same problem. Edit: this particular device is iPhone 4

MarkusWandel 4y ago

Old school? Old school was when you could put up a harmless, noncommercial, mostly static HTML web site and run it over plain http without being considered some info security risk outlier. I have one of these web sites. After some coaching from a modern web literate colleague, it now autopromotes to https using a LE certificate. It works. Or does it? Half my relatives who access a (private and password protected) photo server promptly reported losing access. This is the still using 32-bit Chrome on Windows XP, save a password in a browser once and then never think about it again, kind of crowd.

sourcecodeplz 4y ago
True dat, way to many devs nowadays don't really test things properly. Accessibility is something I've always taken a liken to, sometimes maybe obsessively. But them again I interacted and went to workshops with people from places around the world that don't have high speed internet still nor the latest devices. Look at gov.uk ... That site is an accessibility masterpiece.

deleted 4y ago

[deleted]

EMIRELADERO 4y ago

So, the post's title says they won't use LE, but the actual post's content has nothing negative to say about it and instead bashes some other free SSL cert service? Why not use LE instead then?

nulbyte 4y ago
I am equally perplexed. > This is about me finding a supposed alternative and going through the same process of due diligence to understand just what I'd be getting into. I don't think the author has a good understanding of Let's Encrypt. Whatever service the author found claiming to be better seems to be lying, based on the author's experience. For the benefit of the unfamiliar who stumble upon this, getting a Let's Encrypt certificate is a fairly painful process, unless you make it painful. Many hosting providers have the process built into their offering. For those self-hosting, the certbot client is very easy to use, after setting up your site and domain, which you would need to do regardless of what service you use to obtain a certificate. It only gets complicated if you have a complicated set-up, such as a non-public site or are perhaps using some specialized web services software, in which case I would assume you are sufficiently technically inclined to overcome the obstacles you yourself built. In any case, I find free and automated is preferable to expensive and manual.
- justin_oaks 4y ago
  When I first got started with LetsEncrypt, I wanted to do the whole thing manually so I could understand it better. This was probably 4 years ago. I expected a web form to fill out (e.g. what domain to do you want, paste your CSR here, etc.), but such a thing didn't exist. The LetsEncrypt site didn't have much useful in the way of instructions except to say "Use Certbot". So I set up certbot, ran it in manual mode, and got my certificate. Cool. The only problem was that there was a little too much magic. What is this "account" that I'm using to renew my certificate if I never made an account (i.e. username password). What happens if I accidentally delete all the files certbot created for me? And a bunch of other questions. The documentation I found didn't give a whole lot of straightforward answers. Instead I pieced together information from blogs and forum posts. I'm hoping the documentation situation has changed, but I can understand how someone can be confused about LetsEncrypt. Many people are happy to use something without any concerns about how it works. Others want to understand and when they find that they can't, they get frustrated.

9dev 4y ago

She really complains how ACME is bad because a client implementation has code written in lines sometimes exceeding 200 characters..? How about we stop trying to micromanage essential services on our servers, and just get on with literally anything else that brings actual value? Let’s encrypt works, it works without attention, it’s free, and ubiquitous.

joe-collins 4y ago
Whatever technical merit the rest of the rant may have had, screaming that long lines killed puppies certainly burned a lot of provisional credibility.
sourcecodeplz 4y ago
It doesn't work for me, on one of my older phones.
- xcjs 4y ago
  If so, that's by design in a way. That's an indicator that your root level certs are not being maintained or updated. That risk is worse than just a few certificate authorities not being recognized.
sigmoid10 4y ago
>Let’s encrypt works, it works without attention, it’s free, and ubiquitous. It's not so easy, since there is always a tradeoff with these things. The exact same argument could be applied to Java as a backend and many people happily do so... until it turns out that some lone guy in Switzerland, who has thanklessly maintained a highly popular logging library for the last 20 years, forgot to sanitise certain inputs. Aaaand now you have remote code execution on Apple's servers and just about every other Fortune 500 company. The world needs more people who scrutinise widely used security relevant software, not less.
KMnO4 4y ago
The inevitable folly of an engineer is succumbing to that nagging desire to tear down the existing solutions and build your own.

pwdisswordfish9 4y ago

Instead of whinging you could just write your own script, if for some reason you're not okay with running the same code as tons of other people?

metanonsense 4y ago

As someone who had to automate OpenSSL workflows often enough (fortunately, way in the past), the described automated signing workflow sounds much like an automated signing workflow. While I hope that the mentioned 200 character line width is being used more as a literary device (elevating snarkiness) than for an actual argument, I fear the latter. Having said that, don't all (public) SSL signing workflows use web technologies in some way? To me, using some web technologies (aka 'kool aid') specifically made for this purpose, such as jwk, feels better than having some intermediaries sending back and forth CSRs, keys, and whatsoever using home-made interfaces and data structures.

deathanatos 4y ago

… well, I kinda like ACME. It's one of the few actually RESTful protocols out there, so it is quite straight-forward to navigate. The media types are well specified compared to some HTTP APIs.¹ certbot (presuming that's the thing she's talking about the code quality of) can be a bit hard to interface with if you stray outside the default set of use cases, IMO. I don't know why it would be shelling out to openssl, though, when Python has cryptography, which is IMO one of the most pleasant libraries to work with if you need to build X.509 certs or CSRs etc. as it represents those things directly and plainly, and doesn't get in the way. … if the issuance limits on some random third party CA are a problem, … Let's Encrypt has generous limits. ¹my last experience was Github's API … which will happily have an attribute that's an enum, but not tell you what the variants are. Like … seriously? Azure's docs/data structs permit representing many illegal values easily, and don't document, e.g., when two things are mutually exclusive. The lack of REST in Azure's API means what could have easily been just a single attribute holding a URL gets broken out into 5 different attributes strewn across 3 different structs, a VM's initial image, I am looking at you.

trynewideas 4y ago

I would have loved to know more about the setup process and cost for the "old-school" cert. Looking at its metadata, it appears to be from Gandi,[1] which charges US$16/year for a single-address cert that works on standard hosting. (The "free" tier is if you buy Gandi web hosting, which starts at US$6.20/month.) 1: https://www.gandi.net/en-US/security?taxes=no https://www.gandi.net/en-US/security?taxes=no

indigodaddy 4y ago

Park that shit behind Caddy. Case closed.

fargle 4y ago

This was really difficult to parse, unusual for rachelbythebay. The article seems like it's ranting about Let's Encrypt (well it is a little). But a lot of the criticism seems wrong. Ah, the critical quote: > But what about now? This isn't about Let's Encrypt. This is about me > finding a supposed alternative and going through the same process of due > diligence to understand just what I'd be getting into. Somehow, a couple > of weeks ago, *I found this other site which claimed to be better than LE* It's ranting about some other scummy service that's never mentioned by name! It's kind of a scam with accounts and logins and a free tier that only lets you do 3 90 day certificates. Rachel likes the web API better. Well, yeah you still want to steer clear of that! (is it https://zerossl.com/pricing/ https://zerossl.com/pricing/ perhaps?) So then why not circle back to LE? The reason nobody seems to care about the ACME protocol is that it does get the job done. And if you don't like the "certbot" client, which can be kind-of a pain, there are like 50 other implementations. https://letsencrypt.org/docs/client-options/ https://letsencrypt.org/docs/client-options/ So you might not be able to do wildcard domains and the renewal period is a relatively short 90 days (both by design), but it's trouble free and actually free with no draconian limits. https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ Well, goodness please use whatever service you want. And if you dislike the code quality of LE enough to pay for a traditional certificate every 2 years, great. But it seems odd to be ranting about LE by name and then throwing a bunch of critiques about another different unnamed service in at the same time. If you gave up on LE in 2018, you might want to try again. It's honestly pretty decently simple to setup and feels pretty opinionated.

28304283409234 4y ago

> 270 days for one domain or 3 domains for 90 days, and then you're screwed. Isn't that great? Huh? I haven't looked at the fine print but I use quite a few more domains. Never ran into the rate limits.

yjftsjthsd-h 4y ago
With what provider? That part is talking about some unnamed alternative, not letsencrypt.

rubatuga 4y ago

Guessing she is talking about acme.sh, the 8000 line shell script. It has lines like: _dnsAltnames="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile" | grep "^ *DNS:.*" | tr -d ' \n')" But in its defense, acme.sh works on all major OS